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PROPOS ED PL AM TO SQRV ET THE VQLMERABT { TO 
. PMETPJlT ION. CF CIA isSuxaKABMES ' — “ 

1. BADGE SET STEM: 

Vulnerabili ty Factor s : 

a » Possibility of duplication and use vr -it detection* 

TEST? With ordinal cosasercial facilities naks 
ai b&dg$ ggic ■ y^psT& it with a bon/?*, fzdo 
badge® j If ; ire &ra noticeable points 

■ 02 0.32. 2 6S*CiiG tOwt it thPQUgh, US C* 

, b * Possible lack of rigid scrutlrij- of all badges by guards • - * 

TESTS: (1) Check the scrutiny of badges by est- 
) changing badges of several persons 

and see if they are detected, 

• , ' ' ( 2 ) Use a temporary badge after esoir&* 

»... j . , ,_ y tion date* 

.uneck guard observance of restricted 
^ U3S °f different type badges* 

i/'* c« Possible non-return of lost badges* 

TEST. Cheer Pnysicsu Security lost badge records 
.me. proceaure when badge is not recovered-. 

2* PSS_OF TELEPHONES ; 

Vulnerability Factors: A ' ’ 

*• mussISn-SrS^sified information, 

TESTS* (1) Tap telephones, 

^ (2) Make calls and solicit classified in- 
x'oi^mtlori over phone# 

b® Use . 0i " CIA phone for long distance calls to and from' covert or 
* scsm-covert personnel , 

TEST: Tap telephone, 

/ . . ■ 

y'e* Disclosure Of identity of CIA personnel, offices, or phone numbers 
’ over telephone, to outsiders, 

TiST: Review and appraise security rules for 
phone operators on this sub'jest* Test 
points which &pp©sir vulnorsiblo by diking 
from within and without Agency* 

of mjMwmcE amp se rvice pmsomk:.* 

» ■ " «'■ I * limit .... , 

Vulnera bility Factor: 

a, Possibi© lack of adequate identification and supervision of qsa 
personnel, (carpenters, electricians, char people, etc*) telephone 
r*en, roving or; relief guards, chauffeurs, etc, 1 

^ TESTS: (1) Make actual .entrances under ths.ee 

guijes and determine hot*? - much suv>«r— 
vision, is afforded within offices! 
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(2) Check identification untials for 

adequacy o 

lu IDESi :: dCG&TION, RESTRICTION AND SUPERVISIO N OF VISITS , 


Vulnerability Factors : 
^ a a Possible lack of 


good records and system for checking visitors. 
TESTs Examine and appraise records and system 
for cheeking visitors. 


. /b. Possible lack of control or supervision of visitors after entrance. 
. TEST: Make actual visits and determine hour much 

supervision or control is afforded;, 



Possible lack 


of 


good control or vantage by guard at entrance. 
TEST: Survey each guard post and check entrance 
control at rush hours a 



Identification of visitor from other agencies seeking classified 
information. 

TEST: Make actual visit under cover of Statu or 
Defense and ascertain what checks are 
made by various CIA offices to assure 
identification prior to discussing classi- 
fied information . 


So CONTROL OF APPLICANTS FOR EMPLQYMMT : 

Vulnerability Factors : 

Discussion of classified information with applicant in Personnel 
Office. i , 

TEST: Make actual application and obtain inter- 
! views with Personnel. 

Discussion of classified information with applicant by interested 
office upon referral by Personnel for interview. 

TEST: Make actual application and obtain inter- 
views with Personnel and other offices. 

I 

6. UNCLEARED POOL EMPLOYEES: 

a , 0 H .1. HMainn.nl lim-ll»TTT- Tl — TT|— — * 

Vulnera bi lity Facto rs t 

a. Possible use on classified matter. 

TEST: Check ru3.es and procedures for use of un- 
cleared pool personnel. Plant person in 
pool aiid arrange for absence and use in 
office with visitor pass and see if de- 
tected. 

b. Possible absorption of classified information through outside con- 
tacts with future supervisor. 

TEST: Question pool employee -re contacts with 
future supervisors. 
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. * EXTRACTION OF CLASSIFIED MATERIAL FROM OFFICES . 

Vuiner abili ty Factor: 

a« Possible withdrawal of classified papers in brief ca en- 
velopes s or packages. 

TESTs Explore the feasibility and .oticabiliiy 
of repairing passes for ©If . und-carried 
papers, brief cases and ps.=....uges, or the 
| institution of spot checks . 

(Note: This would still not catch the 

material -which could be taken out 
; in pockets or hand bags.) 

8* PENETRATION BY ELECTRONIC DEVICES: 






Vulnerabilit y Factor g 

& a Possible installation of mikes, recorders or transmitters. 

TEST: Survey of sensitive areas. 

PHYSICAL PMIETRkTIOr THROUGH OTHER THAN ORDINARY ENTRANCED; 

Vulnerability Fac tor : 

a« Possible entrance through windows, basements, skylights, etc* 

TEST: Physical survey. 


10. PENETRATION THROUGH FALSE APPLICATION: 


Vulnera bility Factor: 

a. PossxBi“e”eniprbyuent of enemy agent who has submitted PHS covering 
background of security acceptable person* 

TEST: Check personnel and investigative proce- 
dures to ascertain whether such a false 
PHS would be detected* 
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POINTS- GF POSSIBLE VULW SE&BILXTl 

~ musmiTw mmmsiv 


'> SECURITY 


1* OUTSIDE ACTIVITIES 0? EMPLOYEES: 

Vulnerabili t y Fact or: 
a*' Possible vulHerability to exploit* ■ 
through loose talk* 

i TISSTt lest susp 1 employees through associ- 
ation at has, etc* Post listeners in 
shuttle bu- cafeterias, medical wait- 
, . [. 'lag room, e 


by enemy agent or others 


Monitor otgeney pool cars* 


2q former employees* 


Vulner ability Factors: 
a c Possible unwitting exploitation* 

TEST: Check adequacy of exit interview and em- 
phasis on consequences for violations* 

bo Possible open exploitation* 

TEST: Explore possibility of requesting people 

leaving agency to advise us of any attcmuGS 
at exploitation* 

3® EMPLOYEES ORDERED OVERSEAS* 

ur:— ■■ -rr - * ni »— *** " *■■ / v . . -t. 

Vu lnerability Fa ctor: 

a* Possible i&cVof adequate security indoctrination (emolovee ana de- 
pendents)*, * v 

TEv.Ts (Extent of security indoctrination is now 
; doing explored*) 

k* PROCUREMENT PROCEDURE: 

Vu lnera bilit y Fa ctors: 

a 0 Possible inadequate security checks prior to discussion ox" classi- 
fied matters o 

TEST: Explore current procedures* 

9 V 

b* Possible inadequate security checks for those engaged in cl*ssifi«d 
work* " 

TEST: Explore situation with view to . coapart/icn- 
talisiation and/or cut-outs* 

b* HANDLING MAIL AND CABLES* 

Vulnerabili ty Factor: 
a* PossiSfe loose^procedores* • 

i * ISST: Survey sail sad cable handling 
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6© POSSIBLE COMPROMISE OF COVERT PERSOhhKL; 


Vulnerability Factors ' 

a© Visits to CIA offices© 

TESTs Check visitors* log against ~z*t files® 

7© OTHER AGENCY LIAISON PERSONNEL; 

Vulnerabili t y Factor; 

a© Possible personae! security risks in other agencies, 

| TEST; Check basis of security clearance of other 
agency personnel by CIA for its adequacy* 

3© OTHER AGEHCI SECURITY PRACTICES; 

Vulnerabili t y Factor; 

a a possible- compromise of CIA classified documents in other agencies 
by lower security standards and practices* 

TEST; Check present CIA restrictions on other 
agencies against practices* 


it * 
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